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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, tiowever, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

• If the period for reply specified above Is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply Is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)^ Responsive to comnnunication(s) filed on 26 July 2001 : 
2a)\3 This action is FINAL. 2b)|3 This action is non-final, 

3) 0 Since this application is in condition for allowance except for fomnal nnatters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 1 1 , 453 O.G, 21 3. 

Disposition of Claims 

4) 13 Claim(s) 1-26 and 28-82 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) n Claim(s) is/are allowed. 

6) 13 Claim(s) 1-26 and 28-82 is/are rejected. 
?)□ Claim(s) 28-82 is/are objected to. 

8) 0 Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

10) IEI The drawing(s) filed on 30 October 2001 is/are: a)IE accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or fomi PTO-1 52. 

Priority under 35 U.S.C. § 119 

1 2) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 1 9(a)-(d) or (f). 
a)n All b)D Some * c)\J None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1) Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-413) 

2) □ Notice of Draflsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) S Information Disclosure Statement(s) (PTO-1 449 or PTO/SB/08) 5) □ Notice of Informal Patent Application (PTO-1 52) 

Paper No(s)/Mail Date 01/07/04. 03/25/04 . 6) □ Other: . 
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This action is in response to the communication filed on 07/26/2001. 

DETAILED ACTION 

1. Claims 1-26, and 28-82 have been examined. 

Title 

2. The title of the invention is acceptable. 

Priority 

3. No claim for priority has been made for this application. 

4. The effective filing date for the subject matter defined in the pending claims in this 
application is 07/26/2001 . 

Information Disclosure Statement 

5. The information disclosure statements (IDS) submitted on 01/07/2004 and 03/25/2004 
are in compliance with the provisions of 37 CFR 1.97. Accordingly, the examiner is considering 
the information disclosure statement. 

Drawings 

6. The drawings filed on 10/30/2001 are acceptable for examination proceedings. 

Claim Objections 

7. Claims 28-82 are objected to because they are not numbered properly. This is due to the 
fact that no claim 27 was presented in the application, and claim 28 should have been numbered 
claim 27, claim 29 should have been claim 28, and so on. The examiner suggests that in response 
to this action, claims 28-82 are renumbered accordingly. 

Claim Rejections -35 USC § 112 

8. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 
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The specification shall conclude with one or more claims particularly pointing out and 
distinctly claiming the subject matter which the applicant regards as his invention. 

9. Claim 43 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. Claim 43 recites the limitations "said lower level security mode" in line 2, and 
"said higher level security mode" in Lines 2-3. There is insufficient antecedent basis for these 
limitations in the claim. For the purposes of searching art, the examiner will assume the 
limitations should read "a lower level security mode" and "a higher level security mode" 
respectively. 

Claim Rejections - 35 USC §102 

10. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
J 22(b), by another filed in the United States before the invention by the applicant for 
patent or (2) a patent granted on an application for patent by another filed in the United 
States before the invention by the applicant for patent, except that an international 
application filed under the treaty defined in section 351(a) shall have the effects for 
purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 
21(2) of such treaty in the English language, 

11. Claims 1-13, 16-24, 28-41, 44-52, 55-68, 71-79, and 82 are rejected under 35 
U.S.C. 102(e) as being anticipated by Hruska et al (US Patent Number 6,195,587) hereinafter 
referred to as Hruska. 

12. Regarding claims 1, 7, 17, Hruska disclosed a computer program product for controlling 
a computer to detect malware, said computer program product comprising (See Hruska Abstract 
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and Col- 3 Lines 40-54 where it was implied that a computer program product was implemented 
in this system because the system relies on processors, which rely on computer programs): file 
access request detecting logic operable to detect a file access request to a computer file by a 
requesting computer (See Hruska Col 3 lines 63-65); file access clearance request generating 
logic operable to generate a file access clearance request including data identifying said 
computer file (See Hruska Col. 3 Lines 20-24 and Col. 4 Lines 20-23); file access clearance 
request transmitting logic operable to transmit said file access clearance request fi*om said 
requesting computer to an assessment computer responsible for assessment of whether said 
computer file contains malware (See Hruska Col. 3 Lines 20-24 and Col. 4 Lines 20-23); file 
access clearance request receiving logic operable to receive at said assessment computer said file 
access clearance request from a requesting computer (See Hruska Col. 5 Lines 60-66); file access 
clearance response generating logic operable in dependence upon said data identifying said 
computer file to determine if said computer file has previously been assessed as not containing 
malware and to generate a file access clearance response (See Hruska Col. 5 Lines 3-10); file 
access clearance response transmitting logic operable to transmit said file access clearance 
response to said requesting computer (See Hruska Col. 5 Lines 66-67); file access clearance 
response receiving logic operable to receive at said requesting computer said file access 
clearance response from said assessment computer (See Hruska Col. 4 Lines 45-52 and Col. 5 
Lines 66-67 wherein it was implied that the requesting workstation received the report because 
the file server sent the report to the workstation and the workstation used the report); and file 
access permitting logic operable if said file access clearance response indicates said computer 
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file does not contain malware to permit said file access request by said requesting computer (See 
Hruska Col 4 Lines 45-52). 

13. Regarding claims 2, 8, and 18, Hruska disclosed that said data identifying said computer 
file includes a checksum value calculated from said computer file (See Hruska Col. 3 Lines 1-3 
and Col. 4 Lines 13-16). 

14. Regarding claims 3, 9, and 19, Hruska disclosed that said data identifying said computer 
file includes one or more of a filename of said computer file, data identifying said requesting 
computer and a storage location of said computer file (See Hruska Col. 5 Lines 43-48, and 51- 
56). 

15. Regarding claims 4, 10, and 20, Hruska disclosed that if said file access clearance 
response indicates a scan of said computer file is required by said assessment computer, then 
computer file transmitting logic is operable to transmit said computer file from said requesting 
computer to said assessment computer, receiving at said assessment computer said computer file 
from said requesting computer and performing a malware scan of said computer file (See Hruska 
Col. 4 Lines 20-23 and 26-40 and Col. 5 lines 10-13). 

16. Regarding claims 1 1 and 21, Hruska disclosed that if said file access clearance response 
indicates access to said computer file is denied, then triggering a denied access response in said 
assessment computer (See Hruska Col. 5 Lines 18-22). 

17. Regarding claims 5 and 22, Hruska disclosed that if said file access clearance response 
indicates access to said computer file is denied, then triggering a denied access response in said 
requesting computer (See Hruska Col. 4 Lines 52-55). 
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18. Regarding claims 12 and 23, Hruska disclosed that said assessment computer stores a 
database of computer files previously assessed as to whether they contain malware (See Hruska 
Col. 5 Lines 14-18). 

19. Regarding claims 13 and 24, Hruska disclosed that said database includes for each 
computer file fields specifying one or more of a filename of said computer file, data identifying 
said requesting computer and a storage location of said computer file, a checksum value 
calculated from said computer file, an access flag indicating whether access to said computer file 
is denied and a persistence flag indicating whether entries relating to said computer file should 
be purged from said database during purge operations (See Hruska Col. 5 Lines 14-18 and 22- 
25). 

20. Regarding claims 6, 16, and 28, Hruska disclosed that a plurality of requesting computers 
share access to an assessment computer for determining whether file access requests by those 
requesting computers should be denied (See Col. 5 Lines 26-40). 

21. Claims 29-41, 44-52, and 55 are rejected for the same reasons as claims 1-13, 16-24, and 
28 respectively, and fiirther because Hruska discloser encompassed the method of the above 
rejected claims (See Hruska Abstract). 

22. Claims 56-68, 71-79, and 82 are rejected for the same reasons as claims 1-13, 16-24, and 
28 respectively, and further because Hruska discloser encompassed the system of the above 
rejected claims (See Hruska Abstract). 
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Claim Rejections - 35 USC §103 

23. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section J 02 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made, 

24. Claims 14-15, 25-26, 42-43, 53-54, 69-70, and 80-81 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Hruska as applied to claims 7, 17, 35, 45, 62, and 72 above 
respectively, and further in view of Caccavale (US Patent Application Publication Number 
2002/0129277). 

Hruska disclosed denying access to files in the event that they contain characteristic 
forms of viruses (See Col. 1 Lines 62-65 and Col. 4 Lines 45-55), but failed to disclose a 
message being sent to the file server indicating a switch to a mode of operation wherein more 
files are denied for access. Hruska does, however, disclose that a user can indicate that all files 
need to be checked by the file server regardless of prior results (See Hruska Col, 4 Lines 55-57). 

Caccavale teaches that it is often the case that a virus checker program is unable to detect 
a new virus (See Caccavale Paragraph 0075 Lines 1-2). Caccavale further teaches that in such a 
case, an updated anti-virus pattern file should be distributed to the virus checker program, at 
which point all the files can be marked as unchecked in order for all the files to be checked for 
the new virus using the new pattern (See Hruska Paragraph 0075). 
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It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Caccavale in the file checking system of Hruska by sending 
new anti-virus patterns to the file server, and in response to receiving the new pattern, marking 
all the files as unchecked and needing to be scanned. This would have been obvious because the 
ordinary person skilled in the art would have been motivated to protect the workstations from 
files containing new viruses that the file server did not know of when the file was originally 
scanned. In this manner, the fileserver would rescan all the files with a greater likelihood of 
finding a virus and therefore denying access to more files. 

Conclusion 

25. Claims 1-26, and 28-82 have been rejected. 

26. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

a. Albrect (Patent Application publication Number 2001/0005889) disclosed a 
system for scanning files for viruses, which involved transferring files from a remote 
computer to a central server for scanning. 

b. Chan et al. (US Patent Number 6,748,538) disclosed a system for determining the 
integrity of a file by comparing a digest of the file with a previous digest of a file stored 
in a database. 

c. Chen et al. (US Patent Number 5,960,170) disclosed a system for scanning for 
viruses by responding to triggering events, such as accessing a file, by communicating 
with a virus scanning server. 
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d. Goldick (US Patent Number 6,598,060) disclosed a system for checking if a file 
has been scanned for viruses using the most recent virus scanner by supplying each file 
with a version specific property. 

e. Marshall et al. (US Patent Number 4,933,969) disclosed a method of 
authenticating files by storing a MAC for each file in a secure unit. 

f Muhlestein (Patent Application Publication 2002/0103783) disclosed a system for 
determining access to a file by sending a filename to a device which scans the file and 
reports the status of the scan back to the requestor, at which point the access 
determination is made and communicated to the user. 

27. Please direct all inquiries concerning this communication to Matthew Henning whose 

telephone number is (571) 272-3790. The examiner can normally be reached Monday-Friday 

from 9am to 4pm, EST. 

If attempts to reach examiner by telephone are unsuccessfiil, the examiner's acting 

supervisor, Ayaz Sheikh, can be reached at (571) 272-3795. The fax phone number for this 

group is (703) 305-3718. 

Any inquiry of general nature or relating to the status of this application or proceeding 

should be directed to the Group receptionist whose telephone number is (703) 305-3900. 




Assistant Examiner 
Art Unit 2131 
12/2/2004 




